Governing Agentic Identity: Why Security Must Assume Misbehavior

Governing Agentic Identity: Why Security Must “Assume Misbehavior”

During my tenure directing a Security Operations Center for a highly autonomous, fast-moving engineering firm, I eventually surrendered the illusion of maintaining a perfect asset inventory. Tracking “what’s out there” was an exercise in futility; shadow IT was powered by tribal knowledge, and new services were routinely spun up over holiday weekends without a word to security. Recognizing this, I pivoted to asking two far more practical questions:

• What is the blast radius? (What systems and data can this asset actually touch?)
• Where is the kill switch? (How rapidly can I sever its access if it goes rogue?)

This wasn’t born from a grand security philosophy, but from the pragmatic reality of defending an environment where absolute control is a luxury you simply don’t have.

I reflect on this because the industry is currently grappling with a similar existential crisis regarding Artificial Intelligence. With AI lowering the barrier to entry for attackers and accelerating the threat landscape, security leaders are constantly asking how to defend against unpredictable, machine-speed threats. The honest answer? You stop trying to predict them. Instead, you architect your defenses for a world where your threat forecasts will inevitably be wrong.

The Inventory Crisis, Amplified by AI Agents

Today, almost every enterprise falls somewhere on a spectrum between aggressively deploying AI agents and secretly having AI agents deployed by employees without IT’s knowledge. Many organizations have embraced a high risk tolerance, deciding that the productivity gains of giving autonomous agents broad, standing access are worth the potential security trade-offs. I am not here to condemn that choice—I have defended environments built on exactly that premise.

However, we must recognize the fundamental difference between human recklessness and machine autonomy. Humans experience fatigue, they second-guess their decisions, and they fear losing their jobs. AI agents possess none of these natural friction points. They execute tasks at the speed and scale they were programmed for, utilizing whatever access they have been granted, entirely devoid of hesitation.

If a rogue human engineer is a five-alarm fire, a rogue AI agent with identical privileges is that same fire—only this time, no fire department is coming, because security monitoring is historically calibrated to watch human behaviors, not autonomous processes.

A New Paradigm: Assume Misbehavior

For years, “assume breach” has been the gold standard of cybersecurity postures. In the era of agentic AI, we must evolve this concept further: assume misbehavior.

This doesn’t necessarily mean the AI has malicious intent. It simply means the agent is executing its exact instructions, but applying them in an unforeseen context that results in unauthorized data access or system manipulation. At enterprise scale, this isn’t a rare anomaly; it is an inevitable operational reality.

So, how do we establish governance over this chaos? It requires a structural shift in how we manage non-human identities:

• Strict, Just-in-Time Scoping: An AI agent should never possess broad, standing access “just in case” it needs it later. It must be granted the exact permissions required for its current task, and nothing more. While this dynamic scoping is operationally heavier than granting permanent broad access, it is non-negotiable for minimizing risk.
• Instant Revocability: Every agentic identity must be engineered with the assumption that you will need to terminate it instantaneously. If revoking an agent’s access requires submitting an IT ticket, scheduling a meeting, or waiting for approvals, you do not possess a security control; you have an administrative bottleneck.
• Authentic Zero Trust: We must move past the marketing buzzword and implement true Zero Trust. This means continuously verifying an agentic identity and its specific requests at every transaction, rather than trusting it indefinitely simply because it passed an initial provisioning check.

This philosophy aligns with the frameworks being advanced by organizations like CoSAI (Coalition for Secure AI). We must stop treating AI agents like neglected service accounts and start treating them as first-class identities within our IAM infrastructure—identities that are continuously audited, strictly governed, and instantly revocable.

Enablement with a Leash

The solution to the proliferation of AI agents is not to become the “Department of No.” Blanket bans are rarely a successful strategy for a CISO looking to retain a seat at the executive table. The modern mandate is to enable the business while keeping it on a tight operational leash.

Allow the business to innovate and move quickly, but architect the underlying access model so that when an agent inevitably misbehaves, the blast radius is microscopic and containment is immediate.

I will concede that this strategy has an expiration date. “Enablement with a leash” works right up until AI agents operate at a level of autonomy and speed that completely outpaces human intervention. Nobody truly knows exactly where that tipping point lies. But I would much rather build the organizational muscle now—enforcing scoping, rapid revocation, and rigorous zero trust—while our current controls still function, rather than waiting for an AI-driven disaster to prove our defenses obsolete.

We cannot predict or fully govern the capabilities of the technology that is coming. We can only control what that technology is permitted to touch, and how rapidly we can sever its access when it behaves unexpectedly. In an era defined by profound unpredictability, establishing that baseline of control is everything.